Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a remote (like in the woods) client using a VPN connection to connect to our office, using this link we can monitor and operate the remote client without a few hours drive in the wild.

This remote linux client uses a "Cellular" uplink, which means bandwidth is billed by the Mbyte.

We are seeing a large cellular bandwidth usage, incompatible with the usage we make of this remote client. The investigation showed that the office network multicast/broadcast traffic is getting all through the VPN and up to the remote client (a complete waste of bandwidth). We are about up to 10Gbytes a month (~15Mb/hour) of 3G data wasted this way, which is getting expensive.

CLIENT>tcpdump -i tap0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tap0, link-type EN10MB (Ethernet), capture size 65535 bytes
10:03:47.582171 IP 192.168.222.22.17500 > 192.168.222.255.17500: UDP, length 130
10:03:47.582390 IP 192.168.222.22.17500 > 255.255.255.255.17500: UDP, length 130
10:03:48.851626 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:03:49.792013 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:03:50.801768 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:03:53.061654 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:03:53.792095 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:03:54.791945 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:03:58.521787 CDPv2, ttl: 180s, Device-ID 'CCD539F222E8', length 92
10:03:59.671763 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:04:00.291688 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:04:01.291826 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:04:06.982023 IP 192.168.222.1.40147 > 239.255.255.250.1900: UDP, length 414
10:04:06.992699 IP 192.168.222.1.40147 > 239.255.255.250.1900: UDP, length 486
10:04:06.992940 IP 192.168.222.1.40147 > 239.255.255.250.1900: UDP, length 482
10:04:06.993177 IP 192.168.222.1.40147 > 239.255.255.250.1900: UDP, length 462
10:04:06.993439 IP 192.168.222.1.40147 > 239.255.255.250.1900: UDP, length 494
10:04:07.121940 IP 192.168.222.1.40147 > 239.255.255.250.1900: UDP, length 476
10:04:07.122242 IP 192.168.222.1.40147 > 239.255.255.250.1900: UDP, length 478
10:04:07.122450 IP 192.168.222.1.40147 > 239.255.255.250.1900: UDP, length 478
10:04:08.301759 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:04:09.291677 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:04:10.291724 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:04:12.212075 ARP, Request who-has 192.168.222.22 tell 192.168.222.2, length 46
10:04:12.381705 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28
10:04:13.291662 ARP, Request who-has 192.168.222.100 tell 192.168.222.22, length 28

Office Side: RT-N16

On the office side, we are using a RT-N16 loaded with "Tomato Firmware v1.28.7501 MIPSR2Toastman-RT K26 USB VPN". Our OpenVPN setup is as follows:

Interface Type:         TAP
Firewall:               Automatic
Client Address Pool:    192.168.222.80-90 (same subnet than office subnet)
Allow Client<-->Client: True

Now I tried setting up iptables rules on the RT-N16 to discard multicast/broadcast packets to no avail.

RTN16>ifconfig
...
tap21      Link encap:Ethernet  HWaddr 00:FF:ED:0A:A9:4A
           UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
           RX packets:9688 errors:0 dropped:0 overruns:0 frame:0
           TX packets:67029 errors:0 dropped:1 overruns:0 carrier:0
           collisions:0 txqueuelen:100
           RX bytes:4606227 (4.3 MiB)  TX bytes:16318123 (15.5 MiB)
...
RTN16>iptables -vnL --line-numbers
Chain INPUT (policy DROP 211 packets, 12660 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1     4618 1818K DROP       all  --  *      *       0.0.0.0/0            224.0.0.0/4
2     1799  404K DROP       all  --  *      *       0.0.0.0/0            255.255.255.255
3     4819  425K DROP       all  --  *      *       0.0.0.0/0            192.168.222.255
4        0     0 ACCEPT     all  --  tun22  *       0.0.0.0/0            0.0.0.0/0
5        0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:1194
6       38  2738 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID
7     1497  203K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
8        1   138 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
9     2402  146K ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0
10       0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           limit: avg 1/sec burst 5
11       0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpts:33434:33534 limit: avg 5/sec burst 5
12       0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp spt:67 dpt:68
13       0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:9999
14       0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:2222
15       0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:1723
16       0     0 ACCEPT     47   --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 DROP       all  --  *      *       0.0.0.0/0            224.0.0.0/4
2        0     0 DROP       all  --  *      *       0.0.0.0/0            255.255.255.255
3        0     0 DROP       all  --  *      *       0.0.0.0/0            192.168.222.255
4        0     0 ACCEPT     all  --  tun22  *       0.0.0.0/0            0.0.0.0/0
5    1007K 1198M            all  --  *      *       0.0.0.0/0            0.0.0.0/0           account: network/netmask: 192.168.222.0/255.255.255.0 name: lan
6        0     0 ACCEPT     all  --  br0    br0     0.0.0.0/0            0.0.0.0/0
7      194  9668 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID
8     2759  161K TCPMSS     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x06/0x02 TCPMSS clamp to PMTU
9     818K 1176M L7in       all  --  vlan2  *       0.0.0.0/0            0.0.0.0/0
10    988K 1195M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
11   12429 1665K wanin      all  --  vlan2  *       0.0.0.0/0            0.0.0.0/0
12    5928  675K wanout     all  --  *      vlan2   0.0.0.0/0            0.0.0.0/0
13    5928  675K ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0
14   12429 1665K upnp       all  --  vlan2  *       0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 614 packets, 61054 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1      920  459K DROP       all  --  *      *       0.0.0.0/0            224.0.0.0/4
2        0     0 DROP       all  --  *      *       0.0.0.0/0            255.255.255.255
3        0     0 DROP       all  --  *      *       0.0.0.0/0            192.168.222.255

Chain L7in (1 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           LAYER7 l7proto skypetoskype
2        0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           LAYER7 l7proto youtube-2012
3        0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           LAYER7 l7proto flash
4     4787 7153K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           LAYER7 l7proto httpvideo
5        0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           LAYER7 l7proto rtp
6        0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           LAYER7 l7proto rtmp
7        0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           LAYER7 l7proto rtmpt
8        0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           LAYER7 l7proto shoutcast
9        0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           LAYER7 l7proto irc

Chain upnp (1 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.222.2       tcp dpt:8080
2        1    52 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.222.2       tcp dpt:40626
3     1595  214K ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.222.2       udp dpt:40626

Chain wanin (1 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.222.2       tcp dpt:8888
2        0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.222.2       udp dpt:8888
3        0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.222.2       tcp dpt:8080
4        0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            192.168.222.2       udp dpt:8080

The following line numbers were added by me.

RTN16>iptables -I FORWARD -d 192.168.222.255 -j DROP
RTN16>iptables -I FORWARD -d 255.255.255.255 -j DROP
RTN16>iptables -I FORWARD -d 224.0.0.0/8 -j DROP
RTN16>iptables -I INPUT -d 192.168.222.255 -j DROP
RTN16>iptables -I INPUT -d 255.255.255.255 -j DROP
RTN16>iptables -I INPUT -d 224.0.0.0/8 -j DROP
RTN16>iptables -I OUTPUT -d 192.168.222.255 -j DROP
RTN16>iptables -I OUTPUT -d 255.255.255.255 -j DROP
RTN16>iptables -I OUTPUT -d 224.0.0.0/8 -j DROP

But I still have these broadcast/multicast packets received by the client. It seems like somehow the routing done by OpenVpn is a bit different as even ARP packets (which are not IP packets per-say) are routed.

Circle back to the question

How can I block the office broadcast/multicast packets (IPv4 and IPv6) to reach my VPN client?

share|improve this question
    
You really should have the clients, or at least this client, in routed mode rather than bridged mode. –  Michael Hampton Oct 28 '13 at 19:07
    
Yes, I see that now. Thing is that I may probably need a ride in the woods to change the setup.. –  philibertperusse Oct 31 '13 at 0:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.